WCF\.Net\C# 中的 WSSE（带摘要）- 一种简单的方法？

Question

免责声明：.Net N00b

几天来，我一直在苦苦挣扎，试图让这个外部供应商网络服务的安全工作无济于事。事实证明，他们使用 WSSE 摘要安全性，简而言之，它在 SOAP 标头中添加了类似这样的内容：

<wsse:UsernameToken wsu:Id="Example-1"> 
   <wsse:Username> ... </wsse:Username> 
   <wsse:Password Type="..."> ... </wsse:Password> 
   <wsse:Nonce EncodingType="..."> ... </wsse:Nonce> 
   <wsu:Created> ... </wsu:Created> 
</wsse:UsernameToken> 

我从添加服务引用开始，并通过许多博客文章、stackoverflow 问题来摆弄 app.config 和代码。我似乎无法做到正确。也许这不容易？也许我只是不太了解 Visual Studio 2010 和 .Net，我不确定。

这是我在 app.config 中停止的内容：

<system.serviceModel>
    <bindings>
        <basicHttpBinding>
            <binding name="ServiceHttpBinding" closeTimeout="00:01:00"
                openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
                allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
                maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
                useDefaultWebProxy="true">
                <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                    maxBytesPerRead="4096" maxNameTableCharCount="16384" />
              <security mode="TransportWithMessageCredential" />
            </binding>
        </basicHttpBinding>
    </bindings>
    <client>
      <endpoint address="https://vendorurl"
          binding="basicHttpBinding" bindingConfiguration="ServiceHttpBinding"
          contract="ContractName"
          name="ServiceHttpPort">
      </endpoint>
    </client>
</system.serviceModel>

还有 C#：

    var someService = new ServiceClient();

    someService.ClientCredentials.UserName.UserName = "username";
    someService.ClientCredentials.UserName.Password = "passwordgobbletygook/somemorebase64stuff=";

    #region Begin Magic
    var elements = someService.Endpoint.Binding.CreateBindingElements();

    var securityBindingElement = elements.Find<SecurityBindingElement>();
    securityBindingElement.IncludeTimestamp = false;

    someService.Endpoint.Binding = new CustomBinding(elements);
    #endregion

    var response = someService.webMethod(param1, param2, param3, param4);

    Console.WriteLine(response);

有趣的是，在供应商规范中，我发现他们鼓励使用 WSSJ，所以我尝试了（在 java 中）并且 我在 2 小时内就可以工作

看起来是这样的：

public class Test implements CallbackHandler {

    /**
     * @param args
     */
    public static void main( final String[] args ) throws Throwable {
        SomeService_Service someService_Service = new SomeService_Service();
        SomeService someService = someService_Service.getSomeServiceHttpPort();

        BindingProvider bindingProvider = (BindingProvider)someService;
        Map< String, Object > requestContext = bindingProvider.getRequestContext();
        requestContext.put( BindingProvider.ENDPOINT_ADDRESS_PROPERTY, "https://vendorurl" );

        Client client = ClientProxy.getClient( someService );
        Endpoint endpoint = client.getEndpoint();

        Map< String, Object > outProps = new HashMap< String, Object >();
        outProps.put( WSHandlerConstants.ACTION, WSHandlerConstants.USERNAME_TOKEN );
        outProps.put( WSHandlerConstants.USER, "username" );
        outProps.put( WSHandlerConstants.PASSWORD_TYPE, WSConstants.PW_DIGEST );
        outProps.put( WSHandlerConstants.PW_CALLBACK_REF, new Test() );

        WSS4JOutInterceptor wssOut = new WSS4JOutInterceptor( outProps );
        endpoint.getOutInterceptors().add( wssOut );

        System.out.println( someService.webMethod(param1, param2, param3, param4) );
    }

    public void handle( final Callback[] callbacks ) throws IOException, UnsupportedCallbackException {
        WSPasswordCallback pc = (WSPasswordCallback)callbacks[ 0 ];

        // set the password for our message.
        pc.setPassword( "passwordgobbletygook/somemorebase64stuff=" );
    }
}

有没有人在 stackoverflow 领域让它在 .Net\C# 中工作？我这里有什么明显的遗漏吗？

Answer 1

我们之前在尝试将基于 .NET 的组件连接到基于 JAVA 的 SOAP 服务时遇到过这个问题。我们的解决方案不涉及任何 XML 构造，恕我直言，比我见过的任何其他解决方案都更干净。

缺点是您需要下载并包含一个较旧的可选 .NET DLL 才能使其工作。好处是代码非常干净，很自然地适合 WCF。

基本实现如下所示：

using (OperationContextScope scope = new OperationContextScope(client.InnerChannel))
{
    //Class from WSE 3.0
    UsernameToken token = new UsernameToken("MY_USERNAME", "MY_PASSWORD", PasswordOption.SendHashed);

    //Add Auth to SOAP Header
    MessageHeader header
      = MessageHeader.CreateHeader(
      "Security",
      "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd",
      token.GetXml(new XmlDocument())
    );

    OperationContext.Current.OutgoingMessageHeaders.Add(header);

    //Build Request
    OrgWS.OrganizationDetailsRequest request = new OrgWS.OrganizationDetailsRequest()
    {
        ID = 1
    };

    //Send Request
    OrgWS.OrganizationDetail[] response = client.getOrganizationDetail(request);

    //Do something with response
}

完整的解释可以在这里找到：http://cxdeveloper.com/article/implementing-ws-security-digest-password-nonce-net-40-wcf

Answer 2

安迪的回答很到位！大部分的发言权都花在这上面，那里有很多，但这是唯一对我有用的答案。非常适合在 SOAP wsse 标头中使用 passwordDigest 添加随机数。同意 Nick V，这个答案应该得到更多的认可。

BasicHttpBinding myBinding = new BasicHttpBinding();
myBinding.Security.Mode = BasicHttpSecurityMode.Transport;
myBinding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;

EndpointAddress ea = new EndpointAddress("****");
WebServiceServiceClient cc = new WebServiceServiceClient(myBinding, ea);

cc.Open();

using (OperationContextScope scope = new OperationContextScope(cc.InnerChannel))
{
    //Class from WSE 3.0
    UsernameToken token = new UsernameToken("userid", "password", PasswordOption.SendHashed);

    //Add Auth to SOAP Header
    MessageHeader header
      = MessageHeader.CreateHeader(
      "Security",
      "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd",
      token.GetXml(new XmlDocument())
    );

    OperationContext.Current.OutgoingMessageHeaders.Add(header);

    try
    {
        //call SOAP methos
    }
    catch (Exception ex)
    {
        //catch any errors
    }
}